1. Authentication Protocols Security Computer Science Tripos part 2 Ross Anderson

2. Security Protocols • Security protocols are the intellectual core of security engineering • They are where cryptography and system mechanisms meet • They allow trust to be taken from where it exists to where it’s needed • But they are much older then computers…

3. Real-world protocol • Ordering wine in a restaurant • Sommelier presents wine list to host • Host chooses wine; sommelier fetches it • Host samples wine; then it’s served to guests • Security properties • Confidentiality – of price from guests • Integrity – can’t substitute a cheaper wine • Non-repudiation – host can’t falsely complain

4. Car unlocking protocols • Principals are the engine controller E and the car key transponder T • Static (T  E: KT) • Non-interactive T  E: T, {T,N}KT • Interactive E  T: N T  E: {T,N }KT • N is a ‘nonce’ for ‘number used once’. It can be a serial number, random number or a timestamp

5. What goes wrong • In cheap devices, N may be random or a counter – one-way comms and no clock • It can be too short, and wrap around • If it’s random, how many do you remember? (the valet attack) • Counters and timestamps can lose sync leading to DoS attacks • There are also weak ciphers – Eli Biham’s 2008 attack on the Keeloq cipher (216 chosen challenges then 500 CPU days’ analysis – some other vendors authenticate challenges)

6. Two-factor authentication S  U: N U  P: N, PIN P  U: {N, PIN}KP

7. Identify Friend or Foe (IFF) • Basic idea: fighter challenges bomber F  B: N B  F: {N}K • But what if the bomber reflects the challenge back at the fighter’s wingman? F  B: N B  F: N F  B: {N}K B  F: {N}K

8. IFF (2)

9. IFF (3) • The middleman attack is very general – Conway discussed how to beat a grandmaster at postal chess • The fix for the man-in-the-middle attack is often application specific • E.g. NATO mode 12 IFF: 32 bit encrypted challenge (to prevent enemy using IFF to locate beyond radar range) at rate of 250 per second